ratonrat | 504cb159c6f69a46531bb2d120c954af246b28f08665efda0b9bafc558886e0a

General

Target
Spoofer.exe
Size 3.5MB
Sample260709-1jcd4sh16l
SHA256 504cb159c6f69a46531bb2d120c954af246b28f08665efda0b9bafc558886e0a
MD5 37570a7b4b3a0e8509a6680fa1617329
SHA1 a74ed13fb5d5d485a92b2ee51def70f0897d7597
SHA512 95a299eae3bb638baefed60bb6a213d88bb2b2b2849e897e24775f393e37a72fb1a5456b35d9d3761687599c94e7abc955167b29ba5f30d83a26c72cea52c2f6
SSDEEP 49152:kmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sL:lq0WgVUuHjkDGjYQeqpgmltL
TLSH
T1AF06CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

ratonrat

Version

v4.0.0

Mutex

JUd5PxQXe0lUeo6pB9MboAM

Attributes

assist
false
box
false
box_icon
Error
box_msg
I'm the message box description
box_title
Hello World
defender
false
delay
0
hide_file
false
open_website
false
process_critical
false
raw
silly21
reconnect
3
startup
false
tag
Infected
uac
false
vm
false
website
https://t.me/example

Targets

- Target
  Spoofer.exe
- Size 3.5MB
- SHA256 504cb159c6f69a46531bb2d120c954af246b28f08665efda0b9bafc558886e0a
- MD5 37570a7b4b3a0e8509a6680fa1617329
- SHA1 a74ed13fb5d5d485a92b2ee51def70f0897d7597
- SHA512 95a299eae3bb638baefed60bb6a213d88bb2b2b2849e897e24775f393e37a72fb1a5456b35d9d3761687599c94e7abc955167b29ba5f30d83a26c72cea52c2f6
- SSDEEP 49152:kmu4tq0WgVUlsHjkmiGWU5+5WeLGpMZ7iKPNgo9sL:lq0WgVUuHjkDGjYQeqpgmltL
- TLSH
  T1AF06CF417BD0CE1BE19F87B6B4F2021057B5EC15A796E70B2E90BAAC1CB37445E1839B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

ratonrat stealer
- Detects RatonRAT payload
- Family: RatonRAT
  RatonRAT is an information stealer written in C#.
  stealer ratonrat
behavioral1
- Target
  costura.dll
- Size 5KB
- SHA256 7a9e767ad824afa2c1b0aed513fe1cf2b8dac6d40f24e7c4075af32b1cf23a20
- MD5 109bd38d2107f41573c48544992ead99
- SHA1 028e9832f421f11f9497c610f1734e0f3d868037
- SHA512 459945f338679c77acca8f1192907cd3ce8e19f270589d34ce8227b8eaf0c7c8c9922e52b8310d037c4d5c0c639de42a6e3b0f7d44d493fc50644b6fcf7cd4e5
- SSDEEP 48:6gMX2nhx3BTjtRiaAVLEP4iZ6iMtTg70uElaQ40JFuUPtomCH9gWk1qyFVA2IbS:HHtRYVLEmYZEZ9ruUPqJmW/2
- TLSH
  T10BB1FB2867B8573BEF7B4BB65863534257B4B950CC279B1F0985B3166C223544931732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  costura.pdb
- Size 7KB
- SHA256 fbb47bfd057253e9461bc7fe661eb8ad273451782f3e227b8db8f88b54cea186
- MD5 dd3394a0ba6f7158d029e1c3a31b7a85
- SHA1 806f4c19b2d7fd9e3b836269ec07647019a29e95
- SHA512 2fbedae58d16bfe20954094e5c7541e1b25310107571e94f7bea35b2217aa634197ef147afb9ffbd9c59aa0f7e209cf2a97349c3503077758502bf7a776e2575
- SSDEEP 192:yMD/wix+PI6jMai+NLy5nj4SCBg5MRkCIFQkC8g7AHOuXk/N/8Hu04:y8YPI6jMai+NLy5nj4SCm5Mz6QkOAHO/
- TLSH
  T1A4F1B33F5748C463C89959720521C49CB6B343202670ED78F3DB2608EDAF69AC7B5772
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  messagepacklib.dll
- Size 10KB
- SHA256 30fc8808c22b5073ca2c691784369a36dbdb855aa1b9e50c909225c5562b0e95
- MD5 e14bf49aa22e8b4b13cee211f9c246dd
- SHA1 67a52a50875b6072355d725cd38dd69a592f6480
- SHA512 5cedb8c0de141be1db2afb60e42621d1ac87b493bceea7fe64eeb774ebfd598155301a498a4b2ec40af89a79192f742b665055c5496c7a20469d0718378061c2
- SSDEEP 192:ittESK1s9acvVfbTa+fwcOADyxZK0ffCZyO+:0EC3jwcOdxZKSCZyJ
- TLSH
  T1B422F91CF380856FCEAA077C7CB216452776F2086553DFAA0D88B4FB5D537A40A22659
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  system.buffers.dll
- Size 20KB
- SHA256 accccfbe45d9f08ffeed9916e37b33e98c65be012cfff6e7fa7b67210ce1fefb
- MD5 ecdfe8ede869d2ccc6bf99981ea96400
- SHA1 2f410a0396bc148ed533ad49b6415fb58dd4d641
- SHA512 5fc7fee5c25cb2eee19737068968e00a00961c257271b420f594e5a0da0559502d04ee6ba2d8d2aad77f3769622f6743a5ee8dae23f8f993f33fb09ed8db2741
- SSDEEP 384:/rMdp9yXOfPfAxR5zwWvYW8a2cyHRN7vCvlbLg:/rMcXP6N6e
- TLSH
  T156926D12DBAC4213DE3B2E7012A4C9C62E3AD3C66A11DB5E1848F5591ED37CACF11B6D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

Detects RatonRAT payload

Family: RatonRAT

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5